Unpatched Broadcom Wi-Fi setup bug lets nearby attackers take over routers

The Hacker News reported on October 19, 2026 on a flaw in Broadcom's Wi-Fi Protected Setup (WPS) code that lets someone within radio range run code as root on Broadcom-based routers, with no Wi-Fi password and no pairing. Security researcher Quentin Kaiser disclosed it on October 16. The bug is in how Broadcom's code reassembles fragmented WPS setup messages, which lets crafted messages corrupt the router's memory.

Kaiser showed working attacks on gateways from three Belgian internet providers. On one Orange Belgium device he read the Wi-Fi password off the router, and on a Proximus gateway he opened a remote shell carried entirely over Wi-Fi frames. He estimates millions of devices worldwide use the affected code. He reports no attacks in the wild, and the working exploits are his own.

There is no fix and no CVE. Kaiser traces the code back to at least 2010 and says Broadcom shipped an incomplete fix in 2018, then pointed customers to the hostapd software instead. Older eCos-based chips such as the BCM3380 may never be patched, while newer Linux-based models could be fixed if vendors switch Wi-Fi software. He has released YARA rules and a scanning script to help spot likely vulnerable gear, and suggests replacing devices that will not get a fix.

Why it matters

Millions of home and small business routers may carry a bug that will never be patched, which turns old hardware into a long-term security risk.

Source: The Hacker News